Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe
-
Size
24KB
-
MD5
143c99abf7332ddc63d095521f8f9d55
-
SHA1
9e29ab6baff953e3077b77e315296acaf58504ae
-
SHA256
8a64784d709b30f949b42bdd224c25291955fa2897551099574c2312a9501504
-
SHA512
9840d0a3b97c15a5c2104b48f2723400afa8d27259aa702c0708c517b3b07ba150a3e4c82cbce80c12b9a6a0d4c943608e29911cc0a6ee8e6758c311cb77224b
-
SSDEEP
384:s/ye8zdTyBsyqAIZhg1wtdtotDRfD+4UHJVJoQRUykzAxBppPYsJWvYXWw4x0w5/:tWsyqAggMtilcoyUy/c2L4OLJa5/
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK} ini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "windir" ini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%windir%\\ini\\shit.vbs" ini.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ini.exe -
Deletes itself 1 IoCs
pid Process 2812 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1300 ini.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\POWER ini.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PROFSVC ini.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WINDEFEND ini.exe -
Loads dropped DLL 2 IoCs
pid Process 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ini.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\ini\desktop.ini 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe File opened for modification C:\Windows\ini\desktop.ini 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: ini.exe File opened (read-only) \??\H: ini.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\wsock32.dll ini.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\wsock32.dll ini.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\de-DE\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\wsock32.dll ini.exe File created C:\Program Files\DVD Maker\de-DE\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\wsock32.dll ini.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\wsock32.dll ini.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\wsock32.dll ini.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\wsock32.dll ini.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\wsock32.dll ini.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\wsock32.dll ini.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\wsock32.dll ini.exe File created C:\Program Files\Microsoft Games\Solitaire\es-ES\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\wsock32.dll ini.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\wsock32.dll ini.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\it-IT\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\Windows Media Player\en-US\wsock32.dll ini.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\wsock32.dll ini.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\wsock32.dll ini.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\wsock32.dll ini.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\wsock32.dll ini.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\wsock32.dll ini.exe File created C:\Program Files\Common Files\System\msadc\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\wsock32.dll ini.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\wsock32.dll ini.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\wsock32.dll ini.exe File opened for modification C:\Program Files\MSBuild\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\wsock32.dll ini.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\wsock32.dll ini.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\wsock32.dll ini.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\wsock32.dll ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\wsock32.dll ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\wsock32.dll ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\wsock32.dll ini.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\ini\shit.vbs ini.exe File created C:\Windows\Tasks\°²×°.bat ini.exe File opened for modification C:\Windows\Tasks\°²×°.bat ini.exe File created C:\Windows\ini\desktop.ini 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe File opened for modification C:\Windows\ini\desktop.ini 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe File created C:\Windows\ini\wsock32.dll ini.exe File opened for modification C:\Windows\ini 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe File opened for modification C:\Windows\ini ini.exe File created C:\Windows\ini\ini.exe 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe File created C:\Windows\ini\shit.vbs ini.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe 1300 ini.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1300 ini.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2068 wrote to memory of 1300 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 28 PID 2068 wrote to memory of 1300 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 28 PID 2068 wrote to memory of 1300 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 28 PID 2068 wrote to memory of 1300 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 28 PID 2068 wrote to memory of 2812 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 29 PID 2068 wrote to memory of 2812 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 29 PID 2068 wrote to memory of 2812 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 29 PID 2068 wrote to memory of 2812 2068 143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\143c99abf7332ddc63d095521f8f9d55_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\ini\ini.exeC:\Windows\ini\ini.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\143C99~1.EXE > nul2⤵
- Deletes itself
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904B
MD5fddf3a7b7372d7b7c0aa2eae2cb582a6
SHA1492f336df8c1a3467b38978955f1ad5ae03a65fd
SHA2565de04384652accddd8e528fbf05453443031b47e23e12a5e219893497cb7a61a
SHA51220ec9393053a3ab47a11ee0c3dcea771fdf7544525f6e89c08bc7b2ac744d8a10265512001377e6520e656f5afa4582fbb9f6616d2e32efdb7173fc255e02c0f
-
Filesize
93B
MD5029cb6e8dd46b0bac89f075426176148
SHA1ac38c1a3e3db05376f191d161500d74251c9e493
SHA256638734859db449bb4597a1f3fff81fbf9c9ba9158fc232bfd0ba5f69eab67ef0
SHA512f74516b98862b508d1714f9757ed22bd76248626ea1eb665f8a3141438c156bb218598adbd089f63c3cf80336e986a5afc2234f18839a8e807ca5c616af29d2b
-
Filesize
17KB
MD562d674465aeb6cb32700fba27c5745d5
SHA1ccecf6d66b50643ef70d5c25e0c6814fc55df425
SHA256eea1e1b309f1f7beaf829fa636e2ca15bb9b02c3764c3432721cefbdde3741e5
SHA5125e4e14c85f5f5933e924b0f8186af09356b387d835a04c31cabed881ddaa28d4607937f7474956bd16d5659565f2b00caa1e2d23524e771a48360046e2517a40
-
Filesize
24KB
MD51439743bb3f2271363928da5fbb7bed2
SHA1852d26e8c42cb9d8f2745d1a35bdbb7879404483
SHA256ee3b6e2a5a29e316f4a5bcd4a0aa670674fbcec5c194aba14c133340bc1a9314
SHA51216e7a3ab3cac2b0dfad1bd34100ff75892b7c622477b05226fe6216d89e45269bec3f98e8c4ba53f357935065b17c75067ec4d129ae8dcfe91f86212ecd56207